<pre>
This page *should* be secure, check the source code!

But... the parent window injected the Injectify core

parent → child
</pre>